@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/__tests__/page-access-guard.test.ts

@@ -0,0 +1,217 @@
+import { generatePageAccessGuardModule } from '../src/page-access-guard-generator'
+
+// `utils/auth/page-access.js` is EXECUTED here with a stubbed `next-auth/jwt`
+// and a stubbed entitlement module: the server half of page protection is
+// proven on behaviour. Without a session the page redirects to sign-in (in the
+// visitor's language, keeping where they were going); a session without the
+// role or the subscription gets a 404; every failure — no app secret, a
+// database error, no entitlement query in the project — refuses.
+
+const SESSION_COOKIE = '__Host-next-auth.session-token'
+
+const baseAuth = (pageProtection: Record<string, unknown>): any => ({
+  enabled: true,
+  dataSourceId: null,
+  dataSourceType: null,
+  passwordAuthEnabled: true,
+  providers: [],
+  roles: ['admin', 'member'],
+  tables: {},
+  pageProtection,
+  folderProtection: {},
+  authPages: { signIn: { pageId: 'sign-in', pageName: 'sign-in', route: '/sign-in' } },
+  callbackBaseUrl: '',
+  envKeys: {},
+  customUserProperties: [],
+})
+
+const ADMIN_PAGE = {
+  dashboard: { requiresAuth: true, allowedRoles: ['admin'], pageName: 'd', route: '/dashboard' },
+}
+const MEMBERS_PAGE = {
+  members: {
+    requiresAuth: true,
+    allowedRoles: [] as string[],
+    pageName: 'm',
+    route: '/members',
+    requiresSubscription: true,
+    subscriptionProductIds: ['prod-1'],
+  },
+}
+
+interface Entitlement {
+  entitled?: boolean
+  throws?: boolean
+  calls: Array<{ userId: string; productIds: string[] }>
+}
+
+const loadGuard = (
+  auth: any,
+  options: {
+    token?: Record<string, unknown> | null
+    secret?: string
+    entitlement?: Entitlement
+    revoked?: boolean
+  }
+) => {
+  const { token = null, secret = 'app-secret', entitlement, revoked = false } = options
+  const fakeRequire = (name: string): unknown => {
+    // The shared reader's session-stamp check: see auth-password-security.test.ts.
+    if (name === '../../utils/auth/session-revocation') {
+      return { liveSessionToken: async (live: unknown) => (revoked ? null : live) }
+    }
+    if (name === 'next-auth/jwt') {
+      return {
+        getToken: async (params: { cookieName?: string; secret: string }) =>
+          params.secret === secret && params.cookieName === SESSION_COOKIE ? token : null,
+      }
+    }
+    if (name === './subscriber-access' && entitlement) {
+      return {
+        isSubscriberEntitled: async (userId: string, productIds: string[]) => {
+          entitlement.calls.push({ userId, productIds })
+          if (entitlement.throws) {
+            throw new Error('connection refused')
+          }
+          return entitlement.entitled === true
+        },
+      }
+    }
+    throw new Error('unexpected require: ' + name)
+  }
+  const moduleObj: { exports: any } = { exports: {} }
+  // tslint:disable-next-line:function-constructor
+  new Function(
+    'require',
+    'module',
+    'exports',
+    'process',
+    'console',
+    generatePageAccessGuardModule(auth)
+  )(
+    fakeRequire,
+    moduleObj,
+    moduleObj.exports,
+    { env: secret ? { NEXTAUTH_SECRET: secret } : {} },
+    { error: (): void => undefined }
+  )
+  return moduleObj.exports.guardPageAccess as (context: any, policy: any) => Promise<any>
+}
+
+const contextFor = (
+  resolvedUrl: string,
+  options: { signedIn?: boolean; locale?: string; defaultLocale?: string } = {}
+) => {
+  const headers: Record<string, string> = {}
+  return {
+    req: {
+      headers: {
+        cookie: options.signedIn === false ? '' : `${SESSION_COOKIE}=jwe`,
+        'x-forwarded-proto': 'https',
+      },
+      cookies: options.signedIn === false ? {} : { [SESSION_COOKIE]: 'jwe' },
+    },
+    res: { setHeader: (key: string, value: string) => (headers[key] = value) },
+    resolvedUrl,
+    locale: options.locale,
+    defaultLocale: options.defaultLocale,
+    headers,
+  }
+}
+
+const ADMIN_POLICY = { requiresAuth: true, allowedRoles: ['admin'] }
+const MEMBER_POLICY = {
+  requiresAuth: true,
+  allowedRoles: [] as string[],
+  requiresSubscription: true,
+  subscriptionProductIds: ['prod-1'],
+}
+
+describe('guardPageAccess (utils/auth/page-access.js)', () => {
+  it('sends a visitor without a session to sign-in, keeping the page as callbackUrl', async () => {
+    const guard = loadGuard(baseAuth(ADMIN_PAGE), { token: null })
+    const context = contextFor('/dashboard?tab=2', { signedIn: false })
+
+    expect(await guard(context, ADMIN_POLICY)).toEqual({
+      redirect: { destination: '/sign-in?callbackUrl=%2Fdashboard', permanent: false },
+    })
+    expect(context.headers['Cache-Control']).toBe('private, no-store')
+  })
+
+  it('puts the visitor’s language back on the redirect', async () => {
+    const guard = loadGuard(baseAuth(ADMIN_PAGE), { token: null })
+    const context = contextFor('/dashboard', { signedIn: false, locale: 'es', defaultLocale: 'en' })
+
+    expect((await guard(context, ADMIN_POLICY)).redirect.destination).toBe(
+      '/es/sign-in?callbackUrl=%2Fes%2Fdashboard'
+    )
+  })
+
+  it('never puts an off-site address in the callbackUrl', async () => {
+    const guard = loadGuard(baseAuth(ADMIN_PAGE), { token: null })
+    const context = contextFor('//evil.test/x', { signedIn: false })
+
+    expect((await guard(context, ADMIN_POLICY)).redirect.destination).toBe(
+      '/sign-in?callbackUrl=%2F'
+    )
+  })
+
+  it('refuses every session when the app secret is missing', async () => {
+    const guard = loadGuard(baseAuth(ADMIN_PAGE), {
+      token: { id: 'u1', role: 'admin' },
+      secret: '',
+    })
+
+    expect((await guard(contextFor('/dashboard'), ADMIN_POLICY)).redirect).toBeDefined()
+  })
+
+  it('treats a session revoked by a password change as no session', async () => {
+    const guard = loadGuard(baseAuth(ADMIN_PAGE), {
+      token: { id: 'u2', role: 'admin', __sessionStamp: 'stamp' },
+      revoked: true,
+    })
+    expect((await guard(contextFor('/dashboard'), ADMIN_POLICY)).redirect).toBeDefined()
+  })
+
+  it('answers 404 to a session without the role and lets the role through', async () => {
+    const member = loadGuard(baseAuth(ADMIN_PAGE), { token: { id: 'u1', role: 'member' } })
+    expect(await member(contextFor('/dashboard'), ADMIN_POLICY)).toEqual({ notFound: true })
+
+    const admin = loadGuard(baseAuth(ADMIN_PAGE), { token: { id: 'u2', role: 'admin' } })
+    expect(await admin(contextFor('/dashboard'), ADMIN_POLICY)).toBeNull()
+  })
+
+  it('reads the role from roleName or roles the way the workflow routes do', async () => {
+    const byRoleName = loadGuard(baseAuth(ADMIN_PAGE), { token: { id: 'u1', roleName: 'admin' } })
+    expect(await byRoleName(contextFor('/dashboard'), ADMIN_POLICY)).toBeNull()
+    const byRoles = loadGuard(baseAuth(ADMIN_PAGE), { token: { id: 'u1', roles: ['admin'] } })
+    expect(await byRoles(contextFor('/dashboard'), ADMIN_POLICY)).toBeNull()
+  })
+
+  it('lets an entitled subscriber through, asking the entitlement query with the session user', async () => {
+    const entitlement: Entitlement = { entitled: true, calls: [] }
+    const guard = loadGuard(baseAuth(MEMBERS_PAGE), { token: { sub: 'u7' }, entitlement })
+
+    expect(await guard(contextFor('/members'), MEMBER_POLICY)).toBeNull()
+    expect(entitlement.calls).toEqual([{ userId: 'u7', productIds: ['prod-1'] }])
+  })
+
+  it('answers 404 to a session without the subscription, and when the check fails', async () => {
+    const notEntitled: Entitlement = { entitled: false, calls: [] }
+    const guard = loadGuard(baseAuth(MEMBERS_PAGE), {
+      token: { id: 'u1' },
+      entitlement: notEntitled,
+    })
+    expect(await guard(contextFor('/members'), MEMBER_POLICY)).toEqual({ notFound: true })
+
+    const broken: Entitlement = { throws: true, calls: [] }
+    const failing = loadGuard(baseAuth(MEMBERS_PAGE), { token: { id: 'u1' }, entitlement: broken })
+    expect(await failing(contextFor('/members'), MEMBER_POLICY)).toEqual({ notFound: true })
+  })
+
+  it('refuses a subscription policy in a project that emitted no entitlement query', async () => {
+    // No subscriber-only page: the module never requires ./subscriber-access.
+    const guard = loadGuard(baseAuth(ADMIN_PAGE), { token: { id: 'u1', role: 'admin' } })
+    expect(await guard(contextFor('/members'), MEMBER_POLICY)).toEqual({ notFound: true })
+  })
+})

package/__tests__/page-access-route-table.test.ts

@@ -0,0 +1,231 @@
+import { PageAccess } from '@teleporthq/teleport-shared'
+import { generateMiddlewareFile } from '../src/auth-generator'
+import {
+  compileGeneratedMiddleware,
+  extractProtectedRoutes,
+  extractSelfGuardedRoutes,
+} from './_helpers/run-generated-middleware'
+
+// The server half of page protection decides at build time which pages check
+// the session in their own getServerSideProps (`PageAccess` in
+// teleport-shared). It MUST agree with the middleware it backs up: same route
+// table, and for every page the same verdict a guest gets from the compiled
+// middleware — protected (redirected) or let through. A change to one that the
+// other does not mirror fails here.
+
+const baseAuth = (over: Record<string, unknown>): any => ({
+  enabled: true,
+  dataSourceId: 'ds-1',
+  dataSourceType: 'postgres',
+  passwordAuthEnabled: true,
+  providers: [],
+  roles: ['admin', 'staff', 'member'],
+  tables: {},
+  pageProtection: {},
+  folderProtection: {},
+  authPages: {
+    signIn: { pageId: 'sign-in', pageName: 'sign-in', route: '/sign-in' },
+    signUp: { pageId: 'sign-up', pageName: 'sign-up', route: '/sign-up' },
+  },
+  callbackBaseUrl: '',
+  envKeys: {},
+  customUserProperties: [],
+  ...over,
+})
+
+const page = (route: string, over: Record<string, unknown> = {}) => ({
+  requiresAuth: true,
+  allowedRoles: [] as string[],
+  pageName: route,
+  route,
+  ...over,
+})
+
+const FIXTURES: Record<string, any> = {
+  'plain and role-gated pages, an admin subtree, a protected home': baseAuth({
+    pageProtection: {
+      home: page('/', { allowedRoles: ['member'] }),
+      dash: page('/dashboard'),
+      users: page('/admin/users', { allowedRoles: ['admin'] }),
+      staff: page('/admin/tasks', { allowedRoles: ['admin', 'staff'] }),
+      open: page('/brochure', { requiresAuth: false }),
+    },
+  }),
+  'a row-owned list/details pair and a role-gated row-owned page': baseAuth({
+    pageProtection: {
+      list: page('/orders'),
+      details: page('/orders', {
+        routePattern: '/orders/[order_number]',
+        rowOwnerColumn: 'user_id',
+        rowOwnerTable: 'teleport_orders',
+        rowOwnerDifferentiator: 'order_number',
+      }),
+      legacy: page('/receipts', {
+        rowOwnerColumn: 'user_id',
+        rowOwnerDifferentiator: 'receipt_id',
+      }),
+      adminDetails: page('/admin/orders', {
+        allowedRoles: ['admin'],
+        routePattern: '/admin/orders/[id]',
+        rowOwnerColumn: 'user_id',
+        rowOwnerDifferentiator: 'id',
+      }),
+    },
+  }),
+  'subscriber pages merged on one key, and a row-owned subscriber page': baseAuth({
+    pageProtection: {
+      a: page('/members', { requiresSubscription: true, subscriptionProductIds: ['p1'] }),
+      b: page('/members', { requiresSubscription: true, subscriptionProductIds: ['p2', ' p1 '] }),
+      c: page('/vip', { requiresSubscription: true, subscriptionProductIds: [] }),
+      d: page('/lessons', {
+        routePattern: '/lessons/[slug]',
+        rowOwnerColumn: 'user_id',
+        rowOwnerDifferentiator: 'slug',
+        requiresSubscription: true,
+        subscriptionProductIds: ['p3'],
+      }),
+      e: page('/mixed', { requiresSubscription: true }),
+      f: page('/mixed'),
+    },
+  }),
+  'folders: a role folder pulls a row-owned page back, a role-less one does not': baseAuth({
+    pageProtection: {
+      p1: page('/team/reports', {
+        routePattern: '/team/reports/[id]',
+        rowOwnerColumn: 'user_id',
+        rowOwnerDifferentiator: 'id',
+      }),
+      p2: page('/mine', { routePattern: '/mine/[id]', rowOwnerColumn: 'user_id' }),
+      p3: page('/team/board', { requiresSubscription: true, subscriptionProductIds: ['p9'] }),
+      p4: page('/admin-panel-home', { route: '/admin' }),
+    },
+    folderProtection: {
+      team: {
+        requiresAuth: true,
+        allowedRoles: ['staff'],
+        folderName: 'team',
+        parentId: null,
+        children: { p1: 'page', p3: 'page', missing: 'page', sub: 'folder' },
+      },
+      mine: {
+        requiresAuth: true,
+        allowedRoles: [],
+        folderName: 'mine',
+        parentId: null,
+        children: { p2: 'page' },
+      },
+      panel: {
+        requiresAuth: true,
+        allowedRoles: ['admin', 'staff'],
+        folderName: 'admin-panel',
+        parentId: null,
+        children: { p4: 'page' },
+      },
+    },
+  }),
+  'protected sign-in / auth pages and an admin page without roles of its own': baseAuth({
+    pageProtection: {
+      signIn: page('/sign-in'),
+      settings: page('/auth/settings'),
+      reports: page('/admin/reports'),
+    },
+  }),
+}
+
+// Every page route each fixture serves, plus the neighbours a prefix match can
+// reach: sub-pages, look-alike prefixes, the home page.
+const PROBE_ROUTES = [
+  '/',
+  '/dashboard',
+  '/dashboard/[id]',
+  '/dashboards',
+  '/brochure',
+  '/admin',
+  '/admin/users',
+  '/admin/tasks',
+  '/admin/unlisted',
+  '/admin/orders',
+  '/admin/orders/[id]',
+  '/admin/reports',
+  '/orders',
+  '/orders/[order_number]',
+  '/orders/[order_number]/invoice',
+  '/receipts',
+  '/receipts/[receipt_id]',
+  '/members',
+  '/members/[slug]',
+  '/vip',
+  '/lessons',
+  '/lessons/[slug]',
+  '/mixed',
+  '/team/reports',
+  '/team/reports/[id]',
+  '/team/board',
+  '/mine',
+  '/mine/[id]',
+  '/sign-in',
+  '/sign-in/[step]',
+  '/sign-in-offers',
+  '/sign-up',
+  '/auth/settings',
+  '/about',
+]
+
+/** A request path the middleware would see for a page route. */
+const concretePath = (route: string): string => route.replace(/\[[^\]]+\]/g, 'sample-1')
+
+describe('PageAccess mirrors the generated middleware', () => {
+  for (const [name, auth] of Object.entries(FIXTURES)) {
+    describe(name, () => {
+      const middlewareCode = generateMiddlewareFile(auth)
+      const table = PageAccess.buildProtectedRouteTable(auth)
+
+      it('builds the same route table', () => {
+        expect(table.protectedRoutes).toEqual(extractProtectedRoutes(middlewareCode))
+        expect(table.selfGuardedRoutes).toEqual(extractSelfGuardedRoutes(middlewareCode))
+      })
+
+      it('protects a page exactly when the middleware redirects a guest from it', async () => {
+        const middleware = compileGeneratedMiddleware(auth)
+        for (const route of PROBE_ROUTES) {
+          const verdict = await middleware(concretePath(route))
+          const policy = PageAccess.resolveRouteAccessPolicy(table, route)
+          expect({ route, protectedByPage: policy !== null }).toEqual({
+            route,
+            protectedByPage: verdict.kind === 'redirect',
+          })
+        }
+      })
+    })
+  }
+
+  it('resolves a page’s policy from the route it is served from', () => {
+    const auth = FIXTURES['plain and role-gated pages, an admin subtree, a protected home']
+    const policyOf = (folderPath: string[], fileName: string) =>
+      PageAccess.resolvePageAccessPolicy({ outputOptions: { folderPath, fileName } }, auth)
+
+    expect(policyOf([], 'index')).toEqual({ requiresAuth: true, allowedRoles: ['member'] })
+    expect(policyOf(['admin'], 'users')).toEqual({ requiresAuth: true, allowedRoles: ['admin'] })
+    expect(policyOf(['admin'], '[id]')).toEqual({ requiresAuth: true, allowedRoles: ['admin'] })
+    expect(policyOf([], 'brochure')).toBeNull()
+    expect(policyOf([], 'about')).toBeNull()
+    expect(
+      PageAccess.resolvePageAccessPolicy(
+        { outputOptions: { fileName: 'dashboard' } },
+        {
+          ...auth,
+          enabled: false,
+        }
+      )
+    ).toBeNull()
+  })
+
+  it('also protects a page whose path starts with "api", which the middleware matcher skips', () => {
+    const auth = baseAuth({
+      pageProtection: { keys: page('/api-keys', { allowedRoles: ['admin'] }) },
+    })
+    expect(
+      PageAccess.resolvePageAccessPolicy({ outputOptions: { fileName: 'api-keys' } }, auth)
+    ).toEqual({ requiresAuth: true, allowedRoles: ['admin'] })
+  })
+})

package/__tests__/payment-drivers-module.test.ts

@@ -317,6 +317,29 @@ describe('the shared payment core', () => {
     })
   })
 
+  it('reads only a numbered copy of the stored name, the newest, never a variable that merely shares it', async () => {
+    const names: Record<string, string | undefined> = {
+      MOLLIE_API_KEY: undefined,
+      CONFIGURATION_MOLLIE_API_KEY: undefined,
+      CONFIGURATION_MOLLIE_API_KEY_OLDSHOP: 'unrelated',
+      CONFIGURATION_MOLLIE_API_KEY1: undefined,
+      CONFIGURATION_MOLLIE_API_KEY12: undefined,
+    }
+    await withEnv(names, async () => {
+      expect(core.credential('mollie', 'apiKey')).toBe('')
+    })
+    await withEnv(
+      {
+        ...names,
+        CONFIGURATION_MOLLIE_API_KEY1: 'first',
+        CONFIGURATION_MOLLIE_API_KEY12: 'newest',
+      },
+      async () => {
+        expect(core.credential('mollie', 'apiKey')).toBe('newest')
+      }
+    )
+  })
+
   it('reads the secret the editor declared, never the older unnumbered one it replaced', async () => {
     const declared = evaluateEmittedModule<any>(
       generatePaymentCoreCode({

package/__tests__/payment-legacy-webhook-routes.test.ts

@@ -123,15 +123,18 @@ describe('legacy payment webhook routes', () => {
 })
 
 describe('legacy Stripe webhook route — completed checkouts', () => {
-  // Records every statement the route sends to the store's database.
+  // Records every statement the route sends to the store's database; the
+  // order the session names reads as due exactly what it took.
   const fakePg = () => {
     const queries: Array<{ text: string; values: unknown[] }> = []
     function Client(): Record<string, unknown> {
       return {
         connect: async (): Promise<void> => undefined,
-        query: async (text: string, values: unknown[]): Promise<{ rowCount: number }> => {
+        query: async (text: string, values: unknown[]) => {
           queries.push({ text, values })
-          return { rowCount: 1 }
+          return /^SELECT/.test(text)
+            ? { rows: [{ total_amount: '10.00', gift_card_amount: '0', currency: 'USD' }] }
+            : { rowCount: 1 }
         },
         end: async (): Promise<void> => undefined,
       }
@@ -147,12 +150,13 @@ describe('legacy Stripe webhook route — completed checkouts', () => {
         payment_status: paymentStatus,
         payment_intent: 'pi_1',
         amount_total: 1000,
+        currency: 'usd',
         metadata: { orderId: 'order-1' },
       },
     },
   })
   const deliver = async (source: string, event: unknown) => {
-    const { pg, queries } = fakePg()
+    const { pg, queries: all } = fakePg()
     const route = loadRoute(source, async () => ({ ok: true, body: event }), { pg })
     const { reply, fetched } = await withEnv(
       { ...CREDENTIALS, TELEPORT_DB_CONNECTION_STRING: 'postgres://store' },
@@ -162,6 +166,8 @@ describe('legacy Stripe webhook route — completed checkouts', () => {
           async (calls) => ({ reply: await route.post('{}'), fetched: calls.map((c) => c.url) })
         )
     )
+    // The writes; the order read before them is the amount check's.
+    const queries = all.filter((query) => !/^SELECT/.test(query.text))
     return { reply, queries, fetched }
   }
   const ecommerce: any = { orderNotifications: true }
@@ -371,11 +377,100 @@ describe('legacy Stripe webhook route — amounts and payment intents', () => {
       ['jpy', 1234, 1234],
       ['kwd', 12340, 12.34],
     ] as const) {
-      const { posted } = await deliverTo(source, session(currency, minor))
+      const { posted } = await deliverTo(source, session(currency, minor), {
+        total_amount: String(major),
+        gift_card_amount: '0',
+        currency: currency.toUpperCase(),
+      })
       expect(posted('/api/ecommerce/order-notification')[0].json.totalAmount).toBe(major)
     }
   })
 
+  // A session pays its order only when it took, in the order's currency, at
+  // least what the order is due (its total less a gift card): the rule the
+  // workflow-driven webhook and the legacy PayPal route already apply.
+  it('marks nothing paid, invoices nothing and announces nothing for a session that does not pay its order', async () => {
+    const sources = [
+      generateStripeWebhookCode(undefined, { orderNotifications: true } as any),
+      generateStripeWebhookCode(
+        { enabled: true, autoGenerateOnPayment: true } as any,
+        { orderNotifications: true } as any
+      ),
+    ]
+    const order = { total_amount: '50.00', gift_card_amount: '0', currency: 'USD' }
+    for (const source of sources) {
+      for (const [event, row] of [
+        // Short: 49.99 for an order due 50.00.
+        [session('usd', 4999), order],
+        // Another currency, the same digits.
+        [session('eur', 5000), order],
+        // No such order.
+        [session('usd', 5000), null],
+        // An amount the event does not state.
+        [session('usd', null as any), order],
+      ] as Array<[unknown, Record<string, unknown> | null]>) {
+        const { reply, queries, posted } = await deliverTo(source, event, row)
+        expect(reply.status).toBe(200)
+        expect(queries.every((query) => /^SELECT/.test(query.text))).toBe(true)
+        expect(posted('/api/invoices/generate')).toEqual([])
+        expect(posted('/api/ecommerce/order-notification')).toEqual([])
+      }
+    }
+  })
+
+  // A session that collected nothing (a free trial, a 100% coupon) pays only an
+  // order that is due nothing: the same rule, with nothing taken.
+  it('pays nothing with a session that collected nothing, unless the order is due nothing', async () => {
+    const source = generateStripeWebhookCode(undefined, {} as any)
+    const free = {
+      ...session('usd', 0),
+      data: { object: { ...session('usd', 0).data.object, payment_status: 'no_payment_required' } },
+    }
+    const owing = await deliverTo(source, free, { total_amount: '20.00', currency: 'USD' })
+    expect(owing.queries.every((query) => /^SELECT/.test(query.text))).toBe(true)
+    const nothingDue = await deliverTo(source, free, { total_amount: '0', currency: 'USD' })
+    expect(nothingDue.queries.filter((query) => !/^SELECT/.test(query.text))).toHaveLength(1)
+  })
+
+  it('answers 500 when the order cannot be read, so Stripe retries the paid mark', async () => {
+    const source = generateStripeWebhookCode(undefined, {} as any)
+    const failing = {
+      Client: function Client(): Record<string, unknown> {
+        return {
+          connect: async (): Promise<void> => undefined,
+          query: async () => {
+            throw new Error('connection reset')
+          },
+          end: async (): Promise<void> => undefined,
+        }
+      },
+    }
+    const route = loadRoute(source, async () => ({ ok: true, body: session('usd', 1000) }), {
+      pg: failing,
+    })
+    const reply = await withEnv(
+      { ...CREDENTIALS, TELEPORT_DB_CONNECTION_STRING: 'postgres://store' },
+      () =>
+        withFetch(
+          () => ({ status: 200, body: {} }),
+          async () => route.post('{}')
+        )
+    )
+    expect(reply.status).toBe(500)
+  })
+
+  it('pays an order whose gift card covered part of it once the session took the rest', async () => {
+    const source = generateStripeWebhookCode(undefined, {} as any)
+    const { queries } = await deliverTo(source, session('usd', 2000), {
+      total_amount: '50.00',
+      gift_card_amount: '30.00',
+      currency: 'USD',
+    })
+    const writes = queries.filter((query) => !/^SELECT/.test(query.text))
+    expect(writes).toHaveLength(1)
+    expect(writes[0].values).toEqual(['paid', 'paid', 'pi_1', 'order-1'])
+  })
+
   it('invoices a zero-decimal payment intent at its own amount', async () => {
     const source = generateStripeWebhookCode(
       { enabled: true, autoGenerateOnPayment: true } as any,

package/__tests__/payment-webhook-route.test.ts

@@ -1,7 +1,7 @@
 import * as crypto from 'crypto'
 import { generateWebhookWorkflowAPIRoute } from '../src/api-route-generator'
 import { loadServerRuntime } from './_helpers/load-server-runtime'
-import { withEnv, withFetch } from './_helpers/fake-fetch'
+import { FETCH_BACKED_NETWORK, withEnv, withFetch } from './_helpers/fake-fetch'
 import { loadPaymentDrivers } from './_helpers/load-payment-drivers'
 
 /**
@@ -66,6 +66,9 @@ const loadRoute = (source: string, drivers: Record<string, { verifyWebhook: Veri
       }
       return { get: (providerId: string) => drivers[providerId] || null }
     }
+    if (id in FETCH_BACKED_NETWORK) {
+      return FETCH_BACKED_NETWORK[id]
+    }
     // eslint-disable-next-line @typescript-eslint/no-var-requires
     return require(id)
   }